CVE-2026-19977
Received Received - Intake

Authentication Bypass in ipTIME A3004T Router

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: VulDB

Description
A vulnerability was detected in EFM ipTIME A3004T 14.19.0. The affected element is the function httpcon_check_session_url of the component Session Validation. Performing a manipulation results in improper authentication. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-17
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-19977
EUVD
EUVD-2026-60037

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
efm iptime_a3004t 14.19.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authentication bypass flaw in the EFM ipTIME A3004T router running firmware 14.19.0. It occurs in the session validation function httpcon_check_session_url, which incorrectly skips authentication checks when the request path does not start with /sess-bin/. Attackers can bypass login by using a path like /cgi/timepro.cgi. The exploit allows unauthorized password resets and full device control.

Detection Guidance

Check if your ipTIME A3004T router is running firmware version 14.19.0. Inspect web interface access logs for unusual requests to /cgi/timepro.cgi or /sess-bin/captcha.cgi. Test if authentication can be bypassed by accessing these paths without valid session tokens.

Commands: Use curl to test paths like curl http://<router-ip>/cgi/timepro.cgi and curl http://<router-ip>/sess-bin/captcha.cgi. Monitor for successful access without login prompts.

Impact Analysis

An attacker can gain full control of your router without authentication. This enables them to reset passwords, change network settings, perform DNS hijacking, modify VPN configurations, or create backdoors. They could also launch denial-of-service attacks or intercept network traffic.

Compliance Impact

This vulnerability allows unauthorized access to the router's web interface, potentially enabling attackers to modify network settings, intercept traffic, or install backdoors. For GDPR, this could lead to unauthorized data access or breaches if the router handles sensitive user data. For HIPAA, if the router is used in healthcare environments, it may expose protected health information (PHI) due to improper authentication.

Mitigation Strategies

Immediately update the router firmware to the latest version if available. Disable remote web interface access if not required. Block external access to ports 80 and 443. Monitor network traffic for suspicious activity targeting these paths.

If no update is available, consider replacing the device or isolating it from critical network segments until a patch is released.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19977. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart